A little give has been added to Project Zero's 90-day action deadline.

Share this story

In a blog post today, the Google Security team announced changes to policies on full disclosure of bugs found by Project Zero, the security research team that uncovered zero-day vulnerabilities recently revealed in Microsoft's Windows 8.1 and Apple's OS X operating systems. Those disclosures, which were made 90 days after Google alerted Microsoft and Apple in accordance with Project Zero's strict release policy, stirred controversy because they had not yet been patched—and gave attackers time to leverage them before Microsoft and Apple distributed fixes.

Project Zero set a 90-day deadline, and since Project Zero's launch, Google's team claimed, "of the 154 Project Zero bugs fixed so far, 85% were fixed within 90 days. Restrict this to the 73 issues filed and fixed after Oct 1st, 2014, and 95% were fixed within 90 days." The Microsoft and Apple bugs disclosed and other deadline misses by vendors, they noted, "were typically fixed very quickly after 90 days. Looking ahead, we’re not going to have any deadline misses for at least the rest of February."

That said, Google is now adding some modifications to its 90-day hard-stop deadline. Vendors can ask for a 14-day grace period before disclosure if they are working on a fix, and deadlines that expire during weekends and holidays will be pushed to the next business day. The Project Zero team will now also ensure that bugs that go past the deadline get a Common Vulnerabilities and Exposures (CVE) identifier pre-assigned through MITRE before they are disclosed to prevent confusion.

Google started Project Zero as part of an effort to help reduce the potential for targeted attacks against individuals and organizations and counter the active, well-funded research into zero-day attacks by criminal and state-sponsored organizations. When the program was announced in July of 2014, Evans wrote, "We’re not placing any particular bounds on this project and will work to improve the security of any software depended upon by large numbers of people, paying careful attention to the techniques, targets and motivations of attackers."

The problem, of course, is that 90-day deadlines don't always match up with Microsoft's patching schedule, and unscheduled operating system patches can cause a great deal of disruption to organizations that need to pre-test and manage patch deployment to a large number of systems. And while Apple recently instituted automatic security updating for some critical bugs, that feature doesn't work with older operating systems, and Apple still has to package and test fixes before release. As a result, the vast majority of system patches still require some action by users or corporate IT.

Adding a 14-day grace period will allow Apple and Microsoft a bit more time to smoothly roll out vulnerability fixes as part of their normal update procedure. But it still doesn't fix the bigger problem of slow response to patches by customers—and that, in part, is because of how disruptive even planned patches can be. Because patches often require system restarts and come with accompanying downtime, organizations may defer pushing patches because of the cost of rolling them out.

Meanwhile, Google's Project Zero team also called on all security researchers "to adopt disclosure deadlines in some form, and feel free to use our policy verbatim if you find our data and reasoning compelling. We’re excited by the early results that disclosure deadlines are delivering—and with the help of the broader community, we can achieve even more." So stand by, security professionals—your patch schedule may get even more relentless.

Share this story

Sean Gallagher
Sean is Ars Technica's IT and National Security Editor. A former Navy officer, systems administrator, and network systems integrator with 20 years of IT journalism experience, he lives and works in Baltimore, Maryland. Emailsean.gallagher@arstechnica.com//Twitter@thepacketrat